added escaping html on server-side